FGSP and geographically separated firewalls

Forum|Forum|10 years ago
May 26, 2016
2 replies
10657 views

Hi all,

I'm hoping someone will be able to help with this query.

I'm looking at implementing a pair of Fortigate 500D firewalls within an MPLS network.

They will be installed in two geographically separate data centres.

Two of the key requirements are configuration synchronisation and session pickup, and unfortunately the Fortigate documentation is a little sparse in this area (to say the least!).

It would seem that FGSP will meet the requirements but my concern is around the synchronisation link. I can't determine if both ends of this link need to be in the same broadcast / subnet or if is it possible to route this traffic over a layer three network.

If someone could confirm either way I'd be very grateful.

Again, there is little documentation around how much traffic session pickup generates over the synchronisation link, so if anyone has got any information at all on this I'd really appreciate it.

Thanks

Dave

Toshi_Esumi

SuperUser

My understanding is the former. But FortiGate HA seems to assume local connections for heartbeat (see an article I found: http://www.fortinetguru.com/2016/03/fgcp-high-availability-fortios-5-2-best-practices/). I'm not sure if latency over L2 MPLS affects to the HA operation, or not. I would test it carefully before putting it into production.

emnoc

New Member

How much latency is involved? With today's modern networks it should not be a issue over MPLS, ethernet or fiber.

We did something like this between 2x Chicago DC that where 30-45miles apart using layer2 redundant dark fiber path and 2 HB interfaces for ACT-STD units.

It worked AS-IS with no issues. Keep in mind the local_lan is a requirement since the HA traffic is not going have next-hop routing definitions.You can always adjust the HA hello HB timers but I don't believe that will be a major concern.

Ken

MikePruett

New Member

Glad my site could be of some assistance to you. As EMNOC has stated this works beautifully over long distances. I have several clients that have HA clusters spread out over miles of real estate in the event of major disaster from weather etc and it works very well.